Article Details
Scrape Timestamp (UTC): 2024-01-22 11:33:50.528
Source: https://thehackernews.com/2024/01/ns-stealer-uses-discord-bots-to.html
Original Article Text
Click to Toggle View
NS-STEALER Uses Discord Bots to Exfiltrate Your Secrets from Popular Browsers. Cybersecurity researchers have discovered a new Java-based "sophisticated" information stealer that uses a Discord bot to exfiltrate sensitive data from compromised hosts. The malware, named NS-STEALER, is propagated via ZIP archives masquerading as cracked software, Trellix security researcher Gurumoorthi Ramanathan said in an analysis published last week. The ZIP file contains within it a rogue Windows shortcut file ("Loader GAYve"), which acts as a conduit to deploy a malicious JAR file that first creates a folder called "NS-<11-digit_random_number>" to store the harvested data. To this folder, the malware subsequently saves screenshots, cookies, credentials, and autofill data stolen from over two dozen web browsers, system information, a list of installed programs, Discord tokens, Steam and Telegram session data. The captured information is then exfiltrated to a Discord Bot channel. "Considering the highly sophisticated function of gathering sensitive information and using X509Certificate for supporting authentication, this malware can quickly steal information from the victim systems with [Java Runtime Environment]," Ramanathan said. "The Discord bot channel as an EventListener for receiving exfiltrated data is also cost-effective." The development comes as the threat actors behind the Chaes (aka Chae$) malware have released an update (version 4.1) to the information stealer with improvements to its Chronod module, which is responsible for pilfering login credentials entered in web browsers and intercepting crypto transactions. Infection chains distributing the malware, per Morphisec, leverage legal-themed email lures written in Portuguese to deceive recipients into clicking on bogus links to deploy a malicious installer to activate Chae$ 4.1. But in an interesting twist, the developers also left behind messages for security researcher Arnold Osipov – who has extensively analyzed Chaes in the past – expressing gratitude for helping them improve their "software" directly within the source code. SaaS Security Masterclass: Insights from 493 Companies Watch this webinar to discover Critical SaaS Security Do's and Don'ts based on a study of 493 companies, offering real-world comparisons and benchmarks.
Daily Brief Summary
Researchers have discovered the NS-STEALER, a sophisticated Java-based information stealer using Discord bots to exfiltrate data.
The malware spreads through ZIP files disguised as cracked software, deploying malicious JAR files onto the victim's system.
NS-STEALER harvests screenshots, credentials, autofill data, and more from over 24 web browsers, in addition to Discord tokens and session data from Steam and Telegram.
Extracted sensitive information is sent to a Discord Bot channel, exploiting Discord as a low-cost command and control (C2) infrastructure.
The malware uses X509Certificate authentication and the Java Runtime Environment (JRE) to efficiently steal information.
In a related development, the Chaes malware (version 4.1) has been updated with enhanced capabilities to steal login credentials and intercept cryptocurrency transactions.
Chaes malware distributors use Portuguese legal-themed email lures for infection, and its developers have cheekily thanked security researcher Arnold Osipov within the code for helping them refine their "software."
A SaaS Security Masterclass webinar offers insights from a study of 493 companies, including critical security best practices and benchmarks.